Privacy Policy

1. Introduction

1.1 Purpose

This Privacy Policy explains how Holataxi (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you use our website, booking system, and related services. It also explains your rights under applicable data protection laws and how to exercise them.

1.2 Scope

This Policy applies to: (a) our website and booking flows available at holataxi.es; (b) communications by email, phone, WhatsApp, or contact forms; and (c) cookies and similar technologies used on our site (see Section 8). This Policy does not apply to third-party websites or services we don’t control. For card payments we use secure processors; see Sections 4–5.

1.3 Who we are

Holataxi is a private hire/chauffeur service operating in Spain. We act as the data controller for the processing described in this Policy (see Section 2).

1.4 Legal framework

We process personal data in accordance with the GDPR (Regulation (EU) 2016/679), Spain’s LOPDGDD (Ley Orgánica 3/2018), and LSSI-CE (Ley 34/2002).

1.5 Key principles

Lawfulness, fairness, transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (see Section 10).

1.6 Updates

We may update this Policy for legal, technical, or business reasons. Material changes will be posted here and, where appropriate, notified. See the “Effective Date” above.

1.7 How to use this document

For what data we collect, see Section 3. For purposes and legal bases, see Section 4. For sharing (e.g., drivers, payment, hosting, analytics), see Section 5. For your rights, see Section 7. For cookies, see Section 8. For contacts, see Section 13.

2. Data Controller Information

• Name: Holataxi
• Business Activity: Private transfers & chauffeur services in Barcelona
• Address: Barcelona, Spain
• Email: holataxibcn@gmail.com
• Phone/WhatsApp: +34 664 02 39 26
• Website: https://holataxi.es

3. Data We Collect

• Booking data: name, contact details, pickup/drop-off, date/time, flight number, passengers, luggage, notes.
• Payment data: processed securely by payment providers (e.g., Stripe). We do not store full card details.
• Communications: emails, WhatsApp messages, form submissions.
• Automatically collected (cookies/analytics): IP, device/browser info, pages visited, time on site; analytics only with consent (see Section 8).

4. Purpose & Legal Basis

• Service & bookings: register/manage reservations, allocate drivers, support. Legal basis: contract (Art. 6(1)(b) GDPR).
• Payments: process secure online payments; issue invoices/receipts. Legal basis: contract & legal obligation (tax/accounting) (Art. 6(1)(b)(c)).
• Communications: confirmations, updates, reminders via email/phone/WhatsApp. Legal basis: contract.
• Analytics & improvements: measure traffic and improve UX (analytics only with consent). Legal basis: consent (Art. 6(1)(a)).
• Legal compliance & security: fraud prevention, regulatory duties. Legal basis: legal obligation/legitimate interests.
• Marketing (if opted-in): occasional offers; you can withdraw consent anytime. Legal basis: consent.

5. How We Share Data

• Drivers: receive only the data needed to complete your ride (name, pickup/drop, time, flight, contact).
• Payment processors: e.g., Stripe for card payments (PCI-DSS). Card data goes directly to the processor.
• Hosting & IT: web hosting/backup providers with GDPR-compliant agreements.
• Analytics: Google Analytics/Site Kit (runs only with your consent; see Section 8).
• Authorities/legal: when required by law or to protect rights/safety.

6. Retention

• Bookings & invoices: up to 5 years (tax/accounting rules).
• Communications: up to 24 months, or sooner upon request.
• Analytics: per Google settings (typically 14–26 months) and only if consented.
• Marketing: until you withdraw consent.

7. Your Rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (where applicable). To exercise rights, contact holataxibcn@gmail.com. You may also lodge a complaint with the AEPD (Spain).

8. Cookies

We use essential cookies for the site/booking system and (with consent) analytics/marketing cookies. A consent banner (e.g., CookieYes) lets you accept/reject/manage categories. See our Cookies Policy for details and to change preferences anytime.

9. International Transfers

Some providers (e.g., Stripe, Google) may process data outside the EEA under appropriate safeguards such as EU Standard Contractual Clauses.

10. Security

HTTPS encryption; access controls; data minimisation; secure hosting; GDPR-compliant processors; regular updates/monitoring. No method is 100% secure, but we take reasonable measures. If a breach poses risk, we will notify you and the AEPD as required.

11. Children

Services are intended for adults and not directed to children under 16. If we learn we have data from a child without consent, we will delete it.

12. Changes to this Policy

We may update this Policy and will post the new date above. Where appropriate, we will provide additional notice.